b89a49f8a03b18f0d3edc8e62616f8222da47b81544e255d1387c7de0e7b4e60

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0afd8b208211f6d613c002e8d14c0e73.html
Size

2KB
MD5

0afd8b208211f6d613c002e8d14c0e73
SHA1

0b77faa2bcbd0d7a723722910ce520870970d47e
SHA256

b89a49f8a03b18f0d3edc8e62616f8222da47b81544e255d1387c7de0e7b4e60
SHA512

b818e660c4c39a4053d4146c8ec283ca5212d0395aefb5bbffceabefe87f44b0d6d6544758a716dc83fce9c76e969b421af1b647567956afff54cb2c28e6bca2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{700212E1-A726-11EE-8B00-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000a9318a0fc8658d9e44e55ed8bb33a5e1360036c287b4d0a9a54e85cada5167aa000000000e800000000200002000000016fc8c8f51b477894e324df9582f36aac20646dd222999f4acca4bd0cd6d740720000000b92a79271422fd57346923b26b4e844db8fd4ad27bcd1746ce1e89ea75fc97aa40000000552db9531abc31358f2b742062092295cbfad4ecab53f6880631a4f484e4b7f70452e08058ea0bd1ed26879bdaf3273994f2fb6374789c45e30ce548abc14675	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02aec44333bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410111276"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d12e3dd1592690fb82253480a4d921440917ed387fdf087933ad88a7a6f465d3000000000e8000000002000020000000b166eae9f00d2ce2e066f956eea90b502578e77e297c9783d5e7eb83a88621e090000000be6a2d3ec0374b43106fbcf73175fb37e59b2fae25560963078293cbf3c55c31bb069d2306a02128d375218c2ae899b97360052c25b4b40db83469a951d5c16e6b7cdca8d6e592a209ba312459a77dea0915925d27f572ea57ab3024253f4fea1f98038bfd648c4ff8bb6688e614826286f039e7365c09052a4c69ea9e9974508bf2a06f17e144a55a438905ae959d3940000000756961eca98f5c761726770f88a7fbb6bc8c82ace88daa3f4b244d1fbf800c4e831266b18ecfa17bc27297591df7fc1ecba2b28c1f1497594c2baeed2efe90bd	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1548	iexplore.exe
1548	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2716	1548	iexplore.exe	28
PID 1548 wrote to memory of 2716	1548	iexplore.exe	28
PID 1548 wrote to memory of 2716	1548	iexplore.exe	28
PID 1548 wrote to memory of 2716	1548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0afd8b208211f6d613c002e8d14c0e73.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27ce570a4d28d1ec8a2e5bdb8b966d45

SHA1
0411e513a5234eaf8a75395c952f6168d1337007

SHA256
57cf24e6276bb1d30da0101112203bc1e632f0e26f70e859cbc5a7a9c3caff16

SHA512
705eb299312066f4df059bfaca0344ba3585dd5c606109653574d592cc5862648cf36a67bd40afb4728ae2352aa459f96282c6de998b261229c47f9eb1d039db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e0b1021f26b1619011b2d40a57f34c

SHA1
c71153f70b92545e0a35f51c64fdb938f0d7ed70

SHA256
11a6a4c893fed739ae60a6820909e170e6c8dc4bb628775befe78f8f1106474e

SHA512
0bc48353a79b068151993320b4413f4b34dca3139f59e60c5f0dadbb2f01b64b40dc28a28f5958a34b88f41b6332a5f37ac511753013adfde1da6a5558dd650a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c1130503804727220e8cf211a45d715

SHA1
01b32559b1e43be90d377a43547bda4b735a7e8b

SHA256
6ea0a6033a70b7ba82fe794beb2f666d9f99f9bb4d6bc90ce1651a30cac006fa

SHA512
797335f09d9b365906c1aa6377da76b1566bd311642e94ed29b5e58c57bc6318bfd809efe7f6a51da3e0262848b3b2ea414f50248251e285761038114338c036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b60d91b5f99e8746cfc4a6d54f8b15b1

SHA1
bbb042dd07504cec6d15ad432cf9e943036f28f6

SHA256
ef9db4b5f287b7b6ab8aa5d1ed99f99eab9f02aca20043f26418666173967b58

SHA512
7482e9a573ecc8445a35777014d462d32a0383a491e21d4ab76924f34352f83dc2239eca11fda2f93d0ef87892cbe44a8395bd5c9fcfc0f8a58b10479e1fc60b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01f1d6e6e15520d1ca9632bf2ebb9b51

SHA1
dc9962890abbec1dcf04484c631b802aecb5385b

SHA256
fed6beb4e26240d995f2159e69c4079d1ccc328823b86f79b9b1098e88ed42af

SHA512
0b9e49a7b0554986b0fd606faa0e8fcfc3a13f69d3ca5f16481e4dc30a6c5420d356c6be8d81467dfa135dc42fe69244d6a4c10bbd13e12408c32ca0fe846305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6520138350331bbbfae26dcaeec328c

SHA1
60c9f55f73f67c9f6bd2b3ec58299b526315ea18

SHA256
3ee145de4caac553d0a07f4bb5fb4ffb48f05da99a988c5c59773e5acabbd375

SHA512
b20e3b2df321221c6bb5299c9e5137e3511033057eaad4923462d010d0b0c58fb9e606cf82b4f712f0153b68c28e9090cf54bf1cf323e102fca0ff560e1fbf8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca4be93d31ceb4c33ca3052cf2be7450

SHA1
263089f15f3f274fbb871986fb3dfa71adb3c425

SHA256
f62d357008a5cfeb3d12a1452da7f9ae309bca79da06f10483efa8b99d292613

SHA512
72a7740aeadde74f11f118fd2fa31ed9972ba67d89e0c98667ac43b2160a3904bbb340aeff516cdc68d01f5d223d82ed21caf9203209e545fb2c24c62a3a9752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
992c4f064b31287dbef37d74e023329d

SHA1
eb8ecf46cf19713addf208dfa4ae98d125dc16de

SHA256
ee19d770122dc25fd9a607e1e10d00b9e3b5116b46651cec952735b04a1df135

SHA512
8da4af423b860cb0ae3e4e57c4554839532228e7b617673b0c34fab441d759858139ba1f627f6a03d32a30323019eaea7c2be6ffbbedfcc31627c08de663d7a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52eb56ce1dc855bd45e0fc135d9bd609

SHA1
03e3978ae187bef9ca3b6b67705efd10df60d304

SHA256
93274598abd65a1fe1a1f0f51d1bb780cc6de3aef1d083a7e8ea8564f6e4e172

SHA512
f657403c4d1dcb63b37b57638d2e924724860dffa7b6fd6e6bf8fea59b573b6f324070795e11df6a397e675bd4683846b7f802abdbeb9ae9c158e3e357b54b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4845f22f66465db48c79aa96e7d11ec2

SHA1
6720c9fd9349ed52606bd5f11630ddc3662fb6d3

SHA256
0bc856bfef8748b73f94671717ff42cc37d70aa27ede10ba93ce6d0226da837c

SHA512
894ae9e5d67b95e560a301c4e5de09374ff5883b27cf6876d1c477fcad4979eafa2131a5b6c5bab3709c9edef0786893f5d14d28fc0c93cc811566e8699b4a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bceac89506ca7eea542d8166c48cf215

SHA1
d96743f47d8d8bec79995ff7003cd3c8eeb126cc

SHA256
af20e285ac984f4a59ca310a1b6ca5bc3c9d407b24e2173e0f180ed8ae3a6d0f

SHA512
c303b38dc7fce76db8712809d2a3cef4df986ffc5a9f42535b17c135d4a6cd28555c402be066f811751abd4e1cf732ca9374ec07e88a0b6312c189d60209dffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c6086bd2ad8b2356d7d8a4c0adb9a0c

SHA1
bad825bb6dc38cd3bfdfd15363e93072bba6cadf

SHA256
d24971e754b13fbb1815d1c7da83eded738d187da67a7eae726fd43c17d0c80d

SHA512
31b0a7641652687b222113f25221f2ecefcb52cfb9896a31735d63e86d6e5f56493732346ca929bc2f59ab3ed0b951ca6b23cca79642b62efa1d35e328fc66eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1965f3c0f03ec482b7455c7bb0c24881

SHA1
c450ef95228a8cc6345c94ada501442c65f7e34b

SHA256
255034a17762823af9a3204d265e120f30635c73009869b19c15fd5adc426580

SHA512
a8f6d102079221c583507ef76e97c97d21db34bee8ccc25082a61e5b9e4e4d6552c427ffa803e73878e44420c9dda34395e164ff4006c81fb30818cf794ede06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46af7af5acb54ffb65479f6f6e94f49b

SHA1
377d5b0e21292192a53c279a9c4df5c3867b8692

SHA256
6802764e77ff170f1c26f610f030ed1fa51e4f72b511499b8f120f7e0e816831

SHA512
cfa105b00be5ec4d8eb70e8a6c379b74f643d4aa4f24f4fb9639677ec96c9d84c26470ebc375562e15ce20d33e913fb020f74b171f07bd0730fd6a7597329e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5370.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5392.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit